new systemd in rawhide
by Zbigniew Jędrzejewski-Szmek
Hi,
heads-up: systemd 250-rc1 has been built in rawhide.
It's a fairly big release (140 paragraphs in the NEWS file entry) [1],
but there are also some packaging changes that are relevant for Fedora.
There's a bunch of new configuration settings
(RestrictNetworkInterfaces=, StartupAllowedCPUs=, StartupAllowedMemoryNodes=,
[Condition|Assert][Memory|CPU|IO]Pressure=, ExecSearchPath=, RuntimeRandomizedExtraSec=,
TTYRows=/TTYColumns=, [Service] ExitType=, [Automount] ExtraOptions=),
new units (systemd-boot-update.service, factory-reset.target),
support for TPM2-backed credential storage, file system integrity,
and a lot of new features in systemd-networkd, systemd-analyze,
systemd-dissect, systemd-homed, systemd-coredump, sd-boot, and various
other smaller features and enhancements.
Most tools now provide json output for easy postprocessing.
The credential storage stuff could be relevant in the light of the recent
discussion about logins in emergency mode.
There are some dependency changes in packaging in Fedora.
We changed most of the crypto code to use openssl instead of gcrypt.
We also changed various libraries to be dlopened when actually used,
instead of being dynamically linked. The goal is to reduce the
required dependencies. This means that various libraries that were
previously always pulled in, are not listed as Recommends by the various
subpackages:
$ rpm -q --recommends systemd | grep '^lib'
libbpf.so.0()(64bit)
libbpf.so.0(LIBBPF_0.4.0)(64bit)
libcryptsetup.so.12()(64bit)
libcryptsetup.so.12(CRYPTSETUP_2.4)(64bit)
libdw.so.1()(64bit)
libdw.so.1(ELFUTILS_0.186)(64bit)
libelf.so.1()(64bit)
libelf.so.1(ELFUTILS_1.7)(64bit)
libidn2.so.0()(64bit)
libidn2.so.0(IDN2_0.0.0)(64bit)
libpcre2-8.so.0()(64bit)
libpwquality.so.1()(64bit)
libpwquality.so.1(LIBPWQUALITY_1.0)(64bit)
libqrencode.so.4()(64bit)
libxkbcommon(x86-64)
Recommends are normally installed, but if you're using 'dnf --setopt install_weak_deps=False'
or similar, please make sure that you install those libraries too if appropriate.
libgcrypt is pulled in by libsystemd.so, which means it is pretty much
everywhere. The plan is to switch it to being dlopened, because it is only
used for one minor feature irrelevant to almost all users.
Also, I moved more stuff into the -udev subpackage:
systemd-integritysetup, systemd-veritysetup, systemd-binfmt,
systemd-sysctl, systemd-coredump. IIUC, none of those are useful
in containers, so they fit better in -udev which is supposed to be installed
on real hardware or VMs.
systemd-resolved has also seen work, but it mostly has been behind-the-scenes
refactoring. All of the crypto code had been ported from libgcrypt to openssl,
but hopefully that change will be completely invisible. There have been some
bugfixes too, but not enough. I hope to clear some of the outstanding issues
before v250-final.
If there are regressions, please file a bug or let me know otherwise.
[1] https://raw.githubusercontent.com/systemd/systemd/v250-rc1/NEWS
Zbyszek
